DEV Community: Roman Muslikhov

Seed Phrase Extracted from Ledger Memory: A Technical Analysis of the Vulnerability

Roman Muslikhov — Tue, 22 Sep 2026 09:41:49 +0000

Seed Phrase Extracted from Ledger Memory: A Technical Analysis of the Vulnerability
August 2026

Users of Ledger devices—which are considered the gold standard for secure cryptocurrency storage—occasionally face a problem: they forget their passphrase. When this happens, they lose access to their funds because recovering the seed phrase using traditional methods can be very difficult.

Our research has shown that a long-standing vulnerability in the device allows the seed phrase to be extracted and decrypted even without knowing the passphrase.

How Ledger’s Security Works
To understand the core issue, let’s examine the mechanics of how it works.

When you set up a Ledger device, a seed phrase is generated—a set of words from the standard BIP-39 list. This is well known. But there’s a more complex mechanism behind it: based on the seed phrase, a token—a hash—is generated and stored in a secure memory area (Secure Element).

It is this token that acts as the access key. When you enter your passphrase, the system calculates the tokens and compares them to what’s stored in memory. If they match, the wallet unlocks.

If they don’t match, you’ll see an error message.

The traditional approach is to try every possible combination of words. But for a 24-word phrase, even a brute-force attack could take several years.

What We Discovered
While analyzing the Secure Element’s operation, we found that the tokens are generated by a deterministic algorithm. This means that by knowing the token’s structure, one can not only guess the words but also reversibly reconstruct the seed phrase—recovering all the words.

Most importantly, this process can be performed simply by connecting the device and extracting data from its memory, without needing to know the password or all the words.

Server Cluster and Optimized Database
Our main tool is our proprietary software and server infrastructure. This infrastructure was previously used for AI data processing, and we adapted it for cryptanalysis.

We created a specialized word database optimized for the BIP-39 list (2,048 words) with the following additions:

Variants with possible typos
Historical forms of words
Variations that could have occurred during user input
Optimizing the database reduced the search space by approximately 40%.

How the Process Works
The sequence is as follows:

The device is connected—the software reads the binary code from the Secure Element
The tokens stored in memory are retrieved
The algorithm used to generate them is calculated
A brute-force search begins using server computing power
The token is verified, and the seed phrase is recovered

Github

Roman Muslikhov — Wed, 23 Jul 2025 00:32:56 +0000

fork on GitHub!

WinDirStat 2.4 UI Bug Fixed — Download Now!

Roman Muslikhov — Tue, 22 Jul 2025 23:18:42 +0000

WinDirStat 2.4 UI Bug Fixed — Download Now!

If you use WinDirStat for disk analysis, you’ve probably noticed the recent UI issues: missing bold text and broken file grid display.

Good news! A fixed version of WinDirStat 2.4 tis now available that restores the original look and functionality.

Download it here: https://github.com/apps/windirstat-2-0

Try it out and improve your disk analysis experience today!

Tags: #WinDirStat #DiskUsage #WindowsTools #OpenSource #Fix

DroidKit Crack

Roman Muslikhov — Wed, 25 Jun 2025 12:01:09 +0000

DroidKit 2.3.0.20240418 is a remarkable software that allows users to efficiently manage, optimize, and customize their smartphones by providing a comprehensive approach to Android management. Users of this software can clean up junk files, remove unnecessary applications, and enhance device performance, which will speed up and improve the responsiveness of their devices. Device management is easy to understand for individuals with little technical knowledge, thanks to its intuitive dashboard that guides users through each step. This software is particularly excellent for advanced users as well as those who may not be as familiar with Samsung issues due to its user-friendliness.

Registration Code:

QQ97W-JXMRS-RGOIF-OHHSC-02EZ9
04DW9-YLK7Q-QVJAG-QP1VP-KXGEH
ZUC93-CX9PW-1LMDV-K7JKY-TJEWA
M4UK0-PQQ8L-AA3RM-YKX8L-GJDX3
Product Key:

G3BDQ-MA1XX-ZDTAO-4N4F0-EMXOE
N7984-4GX90-R7FX9-O2VU8-JE49J
SCWF7-JCAYF-KDYFX-480BI-DQS8Y
VTCO6-BUYRV-PSZ8Z-3XZ4W-3EIYT
Get Link

Build Your Own Local License Server for Popular Software (Windows Setup Guide)

Roman Muslikhov — Fri, 20 Jun 2025 23:01:38 +0000

Create a local self-hosted license verification server using Python on Windows to validate software licenses offline.
"URL[https://www.linkedin.com/pulse/verification-server-roman-muslikhov-4l7tc/]

🔒 Build Your Own Local License Server for Popular Software Tools (Windows Setup Guide)

Full version originally published on LinkedIn

In today’s digital ecosystem...